Google Android (Pixel): Privilege escalation via unvalidated input in Trusty
Summary
A flaw in the Trusty platform code of the Android kernel (function ac_set_ns_ipa_tbl in plat_trusty.c) on Google Pixel devices allows unvalidated parameters to corrupt stream table entry configurations. A local attacker who already has System-level privileges can use this to escalate privileges further. No user interaction is needed. NVD had not analysed the CVE at publication, so the CVSS score of 6.7 is provisional.
Affected
- Google Pixel devices with Android kernel builds before security patch level 2026-11-05 (according to the research notes)
- Exact affected Android and Pixel build numbers: Unknown.
Fixed in
- Security patch level 2026-11-05 or later, according to the Pixel Update Bulletin November 2026 and the research notes. The bulletin excerpt provided does not show this CVE, so verify on the bulletin page.
Workaround
Unknown. No vendor workaround found.
Exploitation
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Install the November 2026 Pixel update (patch level 2026-11-05 or later) on all managed Pixel devices.
- Verify the patch level in Settings or through MDM compliance checks.
- Replace or restrict Pixel 6 and Pixel 6 Pro devices, which no longer receive fixes.
- Based on the sources found, servers, firewalls and office PCs are not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record, CVE-2026-56884 www.cve.org
- Pixel Update Bulletin, November 2026 source.android.com
- OSV, PUB-A-511556210 osv.dev
- 9to5Google, November 2026 Pixel update rollout 9to5google.com
- OffSeq Radar (third-party) radar.offseq.com
- Strix (third-party) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:27.
Original description (NVD)
In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.